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REMARKS 

Reconsideration and allowance of the subject application in view of the foregoing 
amendments and the following remarks is respectfully requested. Entry of this Amendment 
Under Rule 1 16 is merited as it raises no new issues and requires no further search and places the 
claims in better condition for appeal. 

Amended and unamended claims 1-28 and 43 satisfy the written description 
requirement of 35 USC 112, first paragraph 

The PTO rejection is not understood as there is no explanation as to what portion of the 
claim language the PTO believes fails to satisfy the written description requirement. Applicants 
are uncertain whether the PTO is referring to only the "automatically" portion of the claim or 
additionally the "regardless of a result of said comparing." With respect to the "automatically" 
portion, Applicants believe sufficient description to be present, fully, clearly, and concisely, in 
the present specification to enable a person skilled in the art to make and use the claimed subject 
matter. For example, reference is made to page 9, lines 1-8 (introducing the Virus Propagation 
Monitoring System (VPMS) as a layer in a communication stack as a monitoring software and 
describing the function as monitoring by observing), page 10, line 2 (setting forth that 
applications send requests to send data via the VPMS), and page 1 1 , lines 24-3 1 (in discussing 
each request, the specification states "as it passes through the VPMS" providing further 
indication of the VPMS not intercepting requests as they pass through the communications 
stack). 

Notwithstanding the foregoing and in order to simplify issues for appeal, the rejection of 
claims 1-28 and 43 is believed overcome in view of the foregoing amendments and withdrawal of 
the rejection is respectfully requested. 
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Amended and unamended claims 1-6, 8, 9, 14-18, 20, 21, 23, 29-35, 38, and 41-43 are 
patentable over Andersen (US 6,122,740) in view of Alexander Shipp (GB 2 367 714) 

The rejection of claims 1-6, 8, 9, 14-18, 20, 21, 23, 29035, 38, and 41-43 under 35 USC 
103(a) as being obvious over Andersen in view of Shipp is hereby traversed. 

First, Andersen fails to disclose or suggest the claimed "establishing a record which is at 
least indicative of identities of destination hosts within the network to whom data has been sent 
by the first host." 

The PTO appears to assert that the access list of Andersen corresponds to the claimed 
feature; however, this is incorrect. Andersen fails to disclose that the access list is indicative of 
hosts "to whom data has been sent by the first host" as claimed. The PTO has failed to identify 
any teaching in Andersen regarding how the access list entries are chosen. For at least this 
reason, withdrawal of the rejection is respectfully requested. 

Second, claim 1 recites that the steps are "carried out by the first host" which the PTO 
has failed to identify in Andersen. Specifically, Andersen appears to recite that the steps, 
asserted by the PTO to correspond to the establishing and storing steps though not agreed to by 
Applicants, are performed remotely. That is, the establishment of the access list in Andersen is 
performed at the log server 150 by a supervisor, and the log data is stored at the log data store 
520 of server 150. 

Contrary to the PTO's assertions otherwise, notably at page 13, lines 10-14 of the Final 
Official Action (FOA), Andersen at column 10, lines 1-56 appears to state that the access list and 
log data should be maintained remotely from the client systems. The relevant portion of the 
relied-upon portion of Andersen, reproduced herein for ease of reference, states: 

In one embodiment, the method and apparatus for remote network access logging 
and reporting discussed above is implemented as a series of software routines run by a 
hardware system of FIG. 9. These software routines comprise a plurality or series of 
instructions to be executed by a processor in a hardware system, such as processor 902 of 
FIG. 9. Initially, the series of instructions are stored on a storage device, such as mass storage 
920. The instructions are copied from storage device 920 into memory 914 and then accessed 
and executed by processor 902. . . . 
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It is also to be appreciated that the present invention can be used for the remote 
logging of any of a wide variety of activities which can be engaged in on a client system. For 
example, a client system 110 of FIG. 1 may be able to receive and display television 
programming. Thus, the television channel and time and date of viewing could be transferred 
to the log server as the log data. Additionally, channel description information could also be 
forwarded, such as selected text from the closed captioning information, or an electronic 
television guide which could be transferred during the vertical blanking interval, or data from 
a preview channel. 

Thus, the present invention provides a method and apparatus for remote network 
access logging and reporting. A record of log data identifying at least the host systems 
accessed, as well as possibly additional information, can be advantageously maintained at 
a remote location. The remote location can then be accessed by a supervisor at will, yet 
the data cannot be altered by an individual user because the data is stored remotely. 
Furthermore, access to particular host systems can advantageously be prevented based on an 
access list which is obtained from a remote location at the time the present invention begins 
running. Thus, the access list is maintained remotely, thereby inhibiting an individual who 
may attempt to alter the list. 

Andersen at column 10, lines 1-56 (emphasis added) 
Based on the foregoing, Andersen appears to disclose remote maintenance of the 
access list and log data contrary to the recitation of claim 1. For at least this reason, 
withdrawal of the rejection is respectfully requested. 



Third, the PTO is requested to clarify with respect to which portion of Andersen the 
PTO believes the "record" of the claimed "establishing a record" corresponds. The FOA 
appears to refer to two differing items of Andersen, i.e., the access list or the log data. For 
example, the PTO refers to Fig. 3 (which includes both the access list and log data), Fig. 5, 
item 512 (which is the "log data storage process" which suggests reliance on the log data), 
column 5, lines 19-23 (which describes log data), and column 6, lines 56-59 (which describes 
the access list). The PTO is requested to clarify which item of Andersen is believed to 
correspond to the claimed "record." For at least this reason, withdrawal of the rejection is 
respectfully requested. 



The PTO admits that Andersen does not disclose a method of monitoring propagation 
of viruses within a network of hosts comprises storing in a buffer data relating to requests 
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which identify a destination host not in the record as claimed in claim 1 . The PTO attempts 
to rely on Shipp to cure the deficiencies of Andersen. However, this is believed to be 
incorrect. 

Fourth, Andersen already includes storage, i.e., log data store 520, for storing data 
about requests and the PTO has failed to identify why a person of ordinary skill in that art 
would have modified Andersen to include a temporary store as in Shipp. 

Fifth, in Andersen (as relied on by the PTO, specifically the non-blocking Fig. 3 
embodiment of Andersen) there is no blocking and thus no need to temporarily store anything 
for later retrieval as asserted by the PTO. That is, the PTO has failed to identify a reason to 
include the temporary store of Shipp in Andersen because in the particular embodiment relied 
on by the PTO there is no storage of blocked emails needed in Andersen. For at least this 
reason, withdrawal of the rejection is respectfully requested. 

Based on the foregoing, withdrawal of the rejection is respectfully requested. 

Claims 2-6, 8, 9, 14-18, 20, 21, 23, and 42 depend, either directly or indirectly, from 
claim 1, include further features, and are patentable over Andersen in view of Shipp for at 
least the reasons advanced above with respect to claim 1. The rejection of claims 2-82-6, 8, 
9, 14-18, 20, 21, 23, and 42 should be withdrawn. 

Claim 43 is patentable over Andersen in view of Shipp for at least reasons similar to 
those advanced above with respect to claim 1 and withdrawal of the rejection is respectfully 
requested. 

Claim 29 is patentable over Andersen in view of Shipp for at least reasons similar to 
those advanced above with respect to claim 1 and withdrawal of the rejection is respectfully 
requested. 

Claims 30-35, 38, and 41 depend, either directly or indirectly, from claim 29, include 
further features, and are patentable over Andersen in view of Shipp for at least the reasons 
advanced above with respect to claim 29. The rejection of claims 30-35, 38, and 41 should 
be withdrawn. 
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The rejections of claims 7, 10-13, 24-27, 19, 22, 36, 37, 39, and 40 variously under 
Andersen in view of Shipp and further in view of one or more of Maker, III et al. (US 
7,058,974), Ramanujan (US 5,341,491), Cunningham et al. (EP 0 986 229), or Anderson (US 
2002/0013858) are traversed, inter alia, for at least the reasons advanced above with respect 
to claim 1. The rejections are respectfully requested to be withdrawn in view of the 
foregoing deficiencies of Andersen and Shipp. 
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CONCLUSION 

Early issuance of a Notice of Allowance is courteously solicited. 

The Examiner is invited to telephone the undersigned, Applicant's attorney of record, to 
facilitate advancement of the present application. 

To the extent necessary, a petition for an extension of time under 37 C.F.R. 1.136 is hereby 
made. Please charge any shortage in fees due in connection with the filing of this paper, including 
extension of time fees, to Deposit Account 08-2025 and please credit any excess fees to such 
deposit account. 



HEWLETT-PACKARD COMPANY 

Intellectual Property Administration 

P.O. Box 272400 
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Facsimile: 970-898-0640 

June 17, 2008 
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